- CatalogClient: POST /memory/search, results via metadata.listing; tenant
visibility filter enforced in the one shared reader client (memory-api
tenant_id is scalar; deviation recorded in the module docstring)
- indexer MemoryClient: upsert = exists-check + store; drop/delete are WARN
no-ops (API has no delete) — reindex is an idempotent fill for now
- refund-overdraw decided: compensating refunds may push a seller negative
(debt, manual reconciliation); data-model amended, property machine updated
- probe doc stored in market:probe partition during API discovery (harmless)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
T013 worker found record_install violating CHECK(amount>0) when platform_pct
rounds cut or seller_amount to zero (unhandled IntegrityError -> HTTP 500).
Fixed: skip zero rows, grant references the paying tx; regression test added.
9 ledger tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
